SEC Consult SA-20131003-0 :: Denial of service vulnerability in

SEC Consult Vulnerability Lab Security Advisory < 20131003-0 >
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
              title: nsconfigd NSRPC_REMOTECMD Denial of service vulnerabil=
ity
            product: Citrix NetScaler
 vulnerable version: NetScaler 10.0 (Build <76.7)
      fixed version: NetScaler 10.0 (Build >=3D76.7)
       not affected: NetScaler 10.1 and 9.3
             impact: Critical
           homepage: http://www.citrix.com
              found: 2012-12-10
                 by: Stefan Viehb=C3=B6ck
                     SEC Consult Vulnerability Lab
                     https://www.sec-consult.com
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Vendor/product description:
---------------------------
"Citrix NetScaler helps organizations build enterprise cloud networks that
embody the characteristics and capabilities that define public cloud servic=
es,
such as elasticity, expandability and simplicity. NetScaler brings to
enterprise IT leaders multiple advanced technologies that were previously
available only to large public cloud providers."

"As an undisputed leader of service and application delivery, Citrix NetSca=
ler
solutions are deployed in thousands of networks around the globe to optimiz=
e,
secure and control the delivery of all enterprise and cloud services. They=
=20
deliver 100 percent application availability, application and database serv=
er
offload, acceleration and advanced attack protection. Deployed directly in
front of web and database servers, NetScaler solutions combine high-speed l=
oad
balancing and content switching, http compression, content caching, SSL
acceleration, application flow visibility and a powerful application firewa=
ll
into a single, easy-to-use platform."

URL: http://www.citrix.com/products/netscaler-application-delivery-controll=
er/overview.html


Vulnerability overview/description:
-----------------------------------
A vulnerability was found in the nsconfigd daemon (TCP port 3008 (SSL) and
3010). This daemon can be crashed by sending a specially crafted message.
No prior authentication is necessary. A watchdog daemon (pitboss) automatic=
ally
restarts nsconfigd after the first six crashes and then reboots the applian=
ce.
By sending just a few packets the appliance can be kept in a constant reboot
loop resulting in total loss of availability.=20


Proof of concept:
-----------------
The nsconfigd daemon can be crashed for six times using the following Python
script. Subsequently the appliance reboots.

Detailed proof of concept exploits have been removed for this vulnerability.


Vulnerable / tested versions:
-----------------------------
The vulnerabilities have been verified to exist in Citrix NetScaler VPX (Bu=
ild
70.7.nc), which was the most recent version at the time of discovery.


Vendor contact timeline:
------------------------
2013-03-27: Contacting vendor through [e-mail].
2013-03-28: Vendor provides encryption key.
2013-03-28: Sending advisory via secure channel.
2013-03-28: Vendor confirms receipt of advisory.
2013-04-08: Requesting status update.
2013-04-19: Requesting status update (again).
2013-04-22: Vendor confirms issues, is "in the process of scheduling requir=
ed
            changes".
2013-06-05: Requesting status update.
2013-06-25: Requesting status update (again).
2013-06-25: Vendor is still "in the process of scheduling changes".
2013-08-14: Requesting status update (again) and setting deadline (Oct. 3rd=
).
2013-09-18: Vendor provides release dates for the update (Oct. 1st and 2nd).
2013-10-03: SEC Consult releases coordinated security advisory.


Solution:
---------
Update to Citrix NetScaler 10.0 Build 76.7.

Vendor information can be found at:
http://support.citrix.com/article/ctx139017


Workaround:
-----------
No workaround available.


Advisory URL:
-------------
https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Vulnerability Lab

SEC Consult
Vienna - Bangkok - Frankfurt/Main - Montreal - Singapore - Vilnius

Headquarter:
Mooslackengasse 17, 1190 Vienna, Austria
Phone:   [phone]
Fax:     [phone]

Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

EOF Stefan Viehb=C3=B6ck / @2013